ISO/IEC 27005 Foundation study plan
ISO/IEC 27005 Foundation · Give each week a clear focus.
8 weeks · About 7 hours per week
Fundamental concepts of information security risk management
Define information security risk, risk source, event, consequence, and likelihood in your own words and map each term to the ISO/IEC 27005 vocabulary
Distinguish risk management from risk assessment, risk treatment, and risk communication, and explain how each fits the overall programme
Explain the relationship between ISO/IEC 27005 and ISO/IEC 27001 clause 6 planning, listing at least four points of contact
Identify the core risk components in a worked scenario and label each one correctly
Your checkpoint
A one-page glossary of 15 ISO/IEC 27005 terms with your own definitions and one example per term
Fundamental concepts of information security risk management
Differentiate asset, threat, vulnerability, existing control, and risk so that none is confused with another
Describe the qualitative, semi-quantitative, and quantitative approaches and state when each is appropriate
Explain risk appetite, risk tolerance, and risk criteria and how they constrain assessment decisions
Interpret a simple risk matrix and justify why a given cell lands where it does
Your checkpoint
A comparison table of qualitative, semi-quantitative, and quantitative approaches with at least three criteria and a recommendation for two contrasting organisations
Fundamental concepts of information security risk management
Establish context, scope, and boundaries for a risk assessment and document the assumptions that follow
Identify assets and classify them by criticality and ownership
Identify threats and vulnerabilities and pair them into realistic threat-vulnerability scenarios
Explain how existing controls change likelihood, consequence, or both
Your checkpoint
A scoped asset inventory of at least 10 assets with owner, criticality, and associated threat-vulnerability pairs
Fundamental concepts of information security risk management
Estimate likelihood and consequence using defined scales and record the rationale for each rating
Calculate risk levels and rank them consistently across a set of scenarios
Evaluate assessed risks against risk criteria and decide which require treatment
Explain residual risk and how it differs from inherent risk
Your checkpoint
A risk register of 12 scenarios with likelihood, consequence, risk level, criteria comparison, and a one-line justification for each rating
Information security risk management approaches and processes
Outline the ISO/IEC 27005 risk management process end to end and name the inputs and outputs of each step
Explain how the process integrates with the ISO/IEC 27001 Plan-Do-Check-Act cycle and the ISMS lifecycle
Describe the role of communication and consultation and identify who must be involved at each stage
Describe monitoring, review, and continual improvement activities and their triggers
Your checkpoint
A process flow diagram with inputs, outputs, owners, and decision points for every step of the risk management process
Information security risk management approaches and processes
Compare the risk treatment options of modification, retention, avoidance, and sharing and match each to realistic situations
Select and justify controls from ISO/IEC 27002 by mapping them to identified risks
Draft a risk treatment plan with owners, deadlines, and success criteria
Explain how acceptance of residual risk is documented and who is accountable for it
Your checkpoint
A risk treatment plan covering five risks, each with chosen option, mapped controls, owner, due date, and acceptance statement
Fundamental concepts of information security risk management & Information security risk management approaches and processes
Walk a full end-to-end assessment on a realistic scenario from context through treatment and acceptance
Identify weaknesses in a supplied risk register and propose specific corrections
Explain how risk assessment results feed the statement of applicability and the risk treatment plan required by ISO/IEC 27001
Answer practice questions on both domains under timed conditions and review every error
Your checkpoint
A complete worked case study of 1,500 words covering assessment, evaluation, treatment, and communication, plus a scored 40-question practice set with error log
Fundamental concepts of information security risk management & Information security risk management approaches and processes
Consolidate weak areas identified in the error log by re-teaching each topic from memory
Recite the key definitions and process steps without notes
Complete two full timed mock exams and analyse results by domain
Review the glossary, comparison tables, and process diagram one final time
Your checkpoint
A final revision sheet of no more than two pages plus mock exam scores with a written remediation note for every missed question
Milestones
Week 2: You can define asset, threat, vulnerability, and risk distinctly and explain the three assessment approaches without notes
Week 4: You have produced a ranked risk register with justified ratings and can explain residual versus inherent risk
Week 6: You can map every risk treatment option to a realistic case and produce a treatment plan with owners and acceptance
Week 8: You score at least 80 percent on two timed mock exams with no domain below 70 percent